ID. Date of interview 
date 42/92/20 


ID. Time interview started 
start 16:38:56 


ID.end Completion date of interview 
Date 42/02/20 


ID.end Time interview ended 
16:57:27 


ID. Duration of interview 
time 18.52 


new Case 


ICO consultation on the draft right of access 
guidance 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 


Does the draft guidance contain the right level of detail? 
O) Yes 
No 
©) Unsure / don't know 


If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Page 11-12 - Can a request be made on behalf of someone? Comment about mental capacity and those 
appointed by the Court of Protection. The existing ICO SAR code of practice makes reference to a 
Property and Affairs Deputy having appropriate authority to make a SAR on behalf of an individual. When 
| have spoken with staff from the Court of Protection, their view was that the other type of Deputy 
(Personal Welfare) would be appropriate to make a SAR, rather than a Property and Affairs Deputy. 
Given the conflicting information and potential risks, it would be helpful if the guidance could be specific 
as to which Court of Protection Orders are considered appropriate authority to make a SAR. Page 30 - In 
what format should we provide the information Comment about the onus on the controller to provide the 
information to the individual, and the individual not having to take action to receive the information. When 
responding to a SAR electronically, we tend to provide the documents under a link to a secure website. 
As part of this security measure, we request the recipient contacts us for the password, as we would lack 
another means of sharing the password. Our view is that this is not onerous for the recipient, and is part 
of how we meet the security principle. Would be helpful if you could consider the acceptability of this in 
the guidance. 


Q3 


Does the draft guidance contain enough examples? 
© Yes 
—) No 

©) Unsure / don't know 

If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


Q4 


We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 

unfounded or excessive’ subject access requests. We would like to include a wide 

range of examples 

from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 

requests below (if applicable). 


Q5 


Q6 


Q7 


On a scale of 1-5 how useful is the draft guidance? 


3 ee: 
1-Notatall 2-Slightly Moderately 
useful useful useful 
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Why have you given this score? 
Guidance is comprehensive, well explained and laid out. 


4 — Very 
useful 


a, 


{ 
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5 — Extremely 
useful 


© 


To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree 
disagree Disagree nor disagree 
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Agree 
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Strongly 
agree 


© 


Q8 


Q9 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


Are you answering as: 


_) An individual acting in a private capacity (eg someone providing their views as a member of the public) 
© An individual acting in a professional capacity 

C) On behalf of an organisation 

() Other 

Please specify the name of your organisation: 


What sector are you from: 
Charity 


Q10 How did you find out about this survey? 
©) ICO Twitter account 
(_ ) ICO Facebook account 
(_) ICO LinkedIn account 
C) ICO website 
©) ICO newsletter 
( ) ICO staff member 
(_) Colleague 
(_) Personal/work Twitter account 
(_) Personal/work Facebook account 
(_) Personal/work LinkedIn account 
(_) Other 
If other please specify: 


